Add a bound on the number of in-flight scrypt hashes.

This adds a simple upper-bound on the number of scrypt hashes in-flight at any one time.  I plucked 100 out of the air as a sensible bound; current traffic puts us at < 4 scrypt-using requests per second and around 0.3 seconds per request, so I don't think we'll need a huge backlog.  Even 1000 might be fine as it's really just a back-stop to malicious activity.

Possible enhancement: a config option for setting this limit, which would also allow us to disable the limit entirely if things go pear-shaped in production.

@dannycoates thoughts?  Style nits welcomed, I've been over in python land for a while :-)